1. Field of the Invention
The present invention relates to storage area networks, and more particularly, to an apparatus and method for preventing the disruption of Fibre Channel Fabrics caused by ReConfigure Fabric (RCF) messages.
2. Background of the Invention
With the increasing popularity of Internet commerce and network centric computing, businesses and other organizations are becoming more and more reliant on information. To handle all of this data, storage area networks or SANs have become very popular. A SAN typically includes a number of storage devices, a number of hosts, and a plurality of Switches arranged in a Switching Fabric. The Switches selectively connect the storage devices and the hosts within the SAN.
Most SANs rely on the Fibre Channel protocol for communication within the Fabric. For a detailed explanation of the Fibre Channel protocol and Fibre Channel Switching Fabrics, see the Fibre Channel Framing and Signaling Standard, Rev 1.70, American National Standard of Accredited Standards Committee (NCITS), Feb. 8, 2002 and the Fibre Channel Switch Fabric—2, Rev. 5.4, NCITS, Jun. 26, 2001, both incorporated by reference herein for all purposes.
In Fibre Channel, each device (hosts, storage devices and Switches) is identified by an unique eight (8) byte wide Node_Name assigned by the manufacturer. When the Fibre Channel devices are interconnected to form a SAN, the Node_Name (along with other parameters) is used to identify each device. Fibre Channel frames are used for communication among the devices in the SAN. The Node_Name, however, is not used by the frames. Instead the Fibre Channel Port of each end device (hosts and storage devices) is addressed via a three (3) byte Fibre Channel address (or FC_ID), allocated dynamically to the end devices by the Fabric. Each end device acquires its FC_ID by performing a Fabric Login procedure with the Switching Fabric. In this procedure, the end device and the Fabric exchange their credentials and the operating parameters required for a successful communication across the SAN. Initially the Fabric identifies itself by an unique Fabric_Name and the end device by its unique Node_Name. Thereafter the Fabric assigns the FC_IDs to the end devices.
The three byte wide Fibre Channel addresses are hierarchically structured in three fields, each one byte long: Domain_ID, Area_ID, and Port_ID. Each Switch within the Fabric is assigned a Domain_ID. The end devices attached to a particular Switch are assigned the Domain_ID of that Switch. The Switch manages the allocation of the Area_ID and Port_ID fields for each end device to guarantee the uniqueness of the assigned addresses in that Domain. For example, if a Switch is assigned a Domain number five and the Switch subdivides its address space in two areas each having three connected end devices, then a possible Fibre Channel address allocation is: 5:1:1, 5:1:2, 5:1:3, 5:2:1, 5:2:2, and 5:2:3.
When the Switching Fabric initializes, one of the Switches is selected as the Principal Switch. The Principal Switch assigns the Domain_IDs to all the Switches in the Fabric and its Node_Name becomes the Fabric_Name of the Switching Fabric. To select the Principal Switch, all the Switches exchange with each other a message called Exchange Fabric Parameters (EFP). The EFP contains, among other parameters, the Node_Name of the sending Switch. The Switch with the lowest Node_Name is designated as the Principal Switch. All the other Switches are referred to as non-principal Switches. Once the Principal Switch is selected, it sends to its neighbor Switches a Domain Identifier Assigned (DIA) message, which informs the neighbor Switches that it has been assigned a Domain_ID by the Principal Switch. In reply, the neighbor Switches send a Request Domain-Identifier (RDI) message to the Principal Switch. The Principal Switch allocates the Domain Ids and responds by sending each Switch its Domain_ID. Thereafter, the Switches that received a Domain_ID send a DIA to their neighbor Switches, receive an RDI in reply, and forward the RDI to the Principal Switch, which assigns the Domain_IDs to the requesting Switches. This process continues until all the Switches received a Domain_ID. After having received a Domain_ID, the individual Switches assign the Area_IDs and Port_IDs for each end device in its Domain. The Fabric configuration is considered completed when all the Switches have been assigned a Domain_ID. Consequently the end devices are all assigned their Area_IDs and Port_IDs.
Fibre Channel allows the merging of two separate Switching Fabrics into one. This happens when a connection is established between two Switches each belonging to a different Fabric. When such an event occurs, the Domain_ID of some of the Switches and the FC_ID of their end devices of the merged Fabric may need to be reassigned. For example, if a Fabric A which includes Domain_IDs one, two and three (1, 2 and 3) is to be merged with a second Fabric B which includes Domain_IDs one and two (1 and 2), then the overlapping Domain_IDs (1 and 2) of one of the Fabrics must be reassigned. When two Fabrics are connected, an EFP message is exchanged across the link that connects them to determine if there is any overlap among the Domain_IDs. Depending on the outcome, one of two things may happen.
If there is any overlap of Domain_ID assignments among the Switches, the link that connects the two original Fabrics is isolated. The link is logically disconnected and is not recognized by the devices, although the physical link still remains. A SAN administrator may then request a disruptive reconfiguration of the joined Fabrics to resolve the Domain_ID conflict. In this case a ReConfigure Fabric (RCF) message is flooded across all the Switches of the two original Fabrics. This stops the delivery of all the data traffic, and each Switch revokes its Domain_ID. Thereafter, a Principal Switch is selected, new Domain_IDs are assigned to the Switches, and new FC_IDs are assigned to the end devices in the same way as described above. In this manner, the two Fabrics are merged into one.
If there is no Domain_ID overlap among the Switches, then a non-disruptive Fabric reconfiguration is automatically performed. A Build Fabric (BF) message is flooded across all the Switches of the two original Fabrics. Data frames delivery is not stopped, and each Switch keeps its Domain_ID. Since the two Fabrics each have a Principal Switch, one of the two has to “resign” from its principal status leaving only one Principal Switch for the merged Fabric. Consequently the Principal Switch selection process described above takes place. Each non-Principal Switch then makes an RDI request to the surviving Principal Switch asking for the same Domain_ID that it had before the BF message. In this way, the two Fabrics are merged without changing any Switch Domain_ID assignments or any FC_IDs assigned to the end devices.
For one of the two original Fabric, however, the Principal Switch is changed. Consequently the Fabric_Name for those Switches needs to be updated. Given that the Fabric_Name is part of the Fabric Login state information that each end device maintains, the Switches of the loosing Fabric have to re-initialize their end devices to update their new status. This process causes a disruption of the data traffic in the Fabric with the losing Principal Switch.
From the perspective of SAN availability, both RCF and BF messages are potentially problematic. A BF may lead to a partial disruption of data traffic in situations where two distinct Fabrics are merged. In general, no disruption occurs if the BF protocol is invoked inside a single Fabric. RCFs, however, will always halt the data traffic across the Fabric while the Principal Switch is identified and the Domain_IDs and FC_IDs are reassigned. As a consequence, RCF messages pose serious security concerns because a Switch in a Fabric maybe used to initiate an RCF, disrupting the functionality of the Fabric.
Traditionally this security problem is solved using “physical security”, where all the Switches of a Fabric are contained inside a secure location and only the system administrator or other authorized personal are allowed to access the Fabric. In this manner, a third party such as a user or client cannot access the Switches of the Fabric and trigger an RCF. But whenever the Switches are not confined in a secure location, as in the case for example of a multi-building enterprise campus, or in the case of Storage Service Providers (SSPs), this approach is not satisfactory.
This problem is especially critical for Storage Service Providers, because they provide storage services to different clients across their infrastructure. If multiple clients are connected to the same Fabric using zoning techniques to isolate their traffic, one client could trigger an RCF. As a result, data flow operations for all clients serviced by the Fabric would be disrupted. This scenario is clearly undesirable from both the Storage Service Provider and the clients perspective.
To address this concern, SSPs typically provide a separate Fabric for each client. Thus if one client wishes to merge or otherwise update its Fabric, the Fabric of other clients will not be effected. This arrangement, however, is less than ideal. Building and maintaining separate Fabrics for each client can be expensive and difficult to manage and support.
An apparatus and method for preventing the disruption of Fibre Channel Fabrics caused by ReConfigure Fabric (RCF) messages is therefore needed.